dsh-cindy-host 0.1.31 → 0.1.33

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.1.33 — 2026-11-04
+
+- Add authorized current-surface reference-source history through native observations, real message identities, filters/cursors and explicit clipping metadata. Keep frozen target-reference capability false and reject structured contexts before every admission/edit/preparation/replay boundary; do not disguise source reads or plain links as target consumption.
+
+- Adapt the existing sidebar custom-order calls to native registered Workspaces and insertBefore, with verified account/device/source stamps, all-key prevalidation, serial native moves and truthful partial/concurrent failure snapshots. Refuse activity and cross-device/unregistered/ambiguous variants; do not create another order store.
+
+- Adapt existing-dialogue recurring reminder CRUD to the native schedule owner with complete-record update CAS, strict execution-field refusals, genuine one-time read/delete and known-created-ID recovery. Forward only committed ready notifications with authorized peer-lifetime cleanup; do not fabricate pause, run history, cost, completion or notifications. Cover the slice with focused Host tests only.
+
+- Adapt the three existing subagent read endpoints to native parent/descendant catalogs, actual consumed-work/live-state evidence and private-context-safe child-owned transcripts. Keep all controls and unproved returned-result capability false; add signed 25-entry/byte-bounded continuation/tail paging and Host-only focused tests. Consume the SDK work reader as a host-provided peer, without installing core/profile packages.
+
+- Add provider-backed Mainland/Global settings-page login: Apple/other enabled social providers, enterprise SSO, regional discovery/confirmation, code delivery, account selection, required binding and SSO verification. Use official endpoint manifests, hosted callback/PKCE/poll-secret or configured loopback fallback; keep all authentication tickets and tokens backend-only. CAPTCHA uses the official challenge page with an explicitly manual successful-URL return in a normal browser.
+- Fence login, cancellation, logout and refresh on the serialized encrypted-credential owner; reject stale UI steps and cross-origin/non-JSON mutations. Rebuild an immutable regional connection context so device-link, media and ICE cannot receive another region's credentials. Include isolated protocol, HTTP, actual local callback, UI state and runtime URL regressions. These regressions do not establish real Apple/enterprise login or iOS acceptance.
+
+- Adapt the official background-task roster to the native owner-fenced jobs registry and reuse native control frames for real task-status updates. Keep stopping nonterminal, omit unknown continuation claims, and never consume output, invent a file/provider/tool origin, or expose fictional stop/output channels. Cover Host owner/state mapping and stale-frame/source teardown fences with focused tests.
+
+- Serve native literal keyword search with real current-message identities/counts, all accepted filters/sorts, genuine limits over 20, bounded scans and cancellation. Refuse explicit semantic/hybrid requests without an enabled native backend; do not pretend global FTS is mounted. Add focused Host protocol field-mapping tests using the official schema as a read-only reference.
+
+- Adapt ordinary fork using committed message identities and exact native user-before/completed-assistant-turn cuts. Return the real child row, publish the existing created event, and retain child IDs across attachment/discovery/source failures without automatically creating another child. Unsupported branch/rewind/encrypted variants stay refused.
+
+- Serve the existing compact-session channel using verified native scoped DSH commands, with strict instructions refusal, real no-op/error results, in-process duplicate-envelope protection, stop/disconnect cancellation, and history invalidation. The Claude queue-compaction protocol is not treated as an alias.
+
+- Wire pin/unpin metadata to the native DSH workspace registry, with membership-only stable wire projection, committed desktop-to-controller refresh, idempotent retries, legacy-overlay retirement, and pre-write mixed-operation validation. No Cindy protocol extension or native timestamp/order claim.
+
+- Fix mobile thinking visibility: send structured `{ text }` content instead of the prose string the mobile normalizer silently drops. Keep ordinary user/assistant prose unchanged.
+- Forward public DSH reasoning chunks during generation, coalesce native thinking pushes, expose the active prefix through history/work details, and retire temporary rows when the durable or interrupted assistant message arrives. Do not transmit private replay metadata or count previews as durable activity.
+- Add regression coverage for the real pinned mobile thinking normalizer, cold/live history, preview retirement, cancellation, routing and teardown. Package/runtime checks are not live-handset acceptance.
+- Route native archive, reminder and project-order event subscriptions through the Host-owned guarded boundary, and pin native replacement fixtures to the real SDK `startSeq`/`endSeq` contract. Synchronize the development lock on the verified 0.2.1-rc.5 carrier while preserving the declared peer compatibility range.
+- Improve the read-only channel audit for imported scalar constants, generic/double-quoted call sites and independent mobile consumers. Explicitly document actual refusals of optional controlled-model catalog, usage widget, machine status and unmapped migration/cloud/provider protocols; this does not enable those features or certify all new Cindy protocols.
+
+## 0.1.32 — 2026-11-03
+
+- Remove keytar and its native npm build chain. Linux/macOS keep system credential vaults through secret-tool/security; Windows encrypts with built-in DPAPI CurrentUser and persists ciphertext through the native DSH credential record service. Login, renewal and logout share one installation-scoped store; failures never fall back to plaintext or pretend a stored login is absent. Windows upgrades may require one explicit login; legacy vault entries are left untouched.
+
+- Add exact DSH `0.2.2-alpha.2` session/settings peers and its Schemastery `3.18.6-alpha.1` peer, retaining the existing rc.3/rc.4/rc.5 carriers. Alpha's own Node.js >=24.9 requirement still applies.
+- Replace removed `standingKeyFor` draft discovery with the current preset revision lease (`acquireScope`), released after successful or failed reads; prefer isolated live-Agent skill services and retain older-carrier fallback.
+- Add lease-lifecycle regressions and a reproducible isolated-alpha core-contract smoke covering real compatibility admission, Loader activation, Session message/input identity and preset skill visibility. Controller/settings/archive method checks are structural only; alpha Web, persistent settings, relay and handset acceptance remain separate gates. The core-contract smoke does not modify or reload a production profile.
+
+- Connect archive/restore metadata to native DSH workspace-registry durability, with native activity checks, cross-device committed archive updates, list-cache invalidation, and explicit unpin acknowledgements. Preserve legacy controller archive flags until an explicit operation retires them; deletion remains non-destructive and Host-local.
+
+- Delegate remote model switching to native DSH when its selection API is composed. The Host now advertises model-window authority so Cindy does not reject DSH selections with its legacy Pi/unknown-capacity precheck. Running-turn selections and selecting the original model again use the same DSH next-request API; no Cindy or DSH core patch is required.
+- Keep missing native selection unavailable and preserve native refusal propagation. Regression coverage includes capability/catalog degradation, all three client aliases, switching back, and the unmodified Cindy consumer guard.
+
 ## 0.1.31 — 2026-10-31
 
 - Merge `main` into the DSH 0.2.1 carrier. `main` was a single working-tree snapshot that had diverged since the 0.2.1 peers landed; every conflict was resolved by keeping the newer, functionally wider side and re-taking `main`'s unique fixes rather than picking a whole file.

package/README.md

@@ -4,14 +4,59 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version 0.1.31 targets the verified **DSH 0.2.1-rc.5** service contracts (also accepting `0.2.1-rc.3` and `0.2.1-rc.4`), with **Node.js >=22.16**. Its DSH peer versions are pinned to those carrier versions to prevent an installer from mixing a newer prerelease SDK into the running host. The verified Desktop runtime includes Node.js 24.21. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
+Version **0.1.33** adds the regional authentication UI, public reasoning streaming and the native capability subsets described below.
+
+It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.31
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.33
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
 
+## 0.1.32: credentials without keytar
+
+No native npm credential module or C++ build toolchain is required. Linux uses `secret-tool` with an unlocked Secret Service (headless sessions need their own DBus/keyring setup); macOS uses the system Keychain through `/usr/bin/security`. Both keep the existing `DSH Cindy Host` service and installation-specific account.
+
+Windows uses built-in Windows PowerShell/.NET DPAPI (CurrentUser), then stores **only encrypted ciphertext** in DSH’s native `credentials` record service. DSH owns the private file, atomic writes and record removal; tokens never enter settings, child-process arguments or logs. No Cindy/Electron integration is required. DSH without the record API, blocked PowerShell, a locked keychain, missing `secret-tool`, or damaged ciphertext produces a storage error, not a missing login or a plaintext fallback.
+
+Windows users upgrading from keytar may need to sign in once through the **DSH settings card**. Old Windows Credential Manager entries are not automatically read or deleted; rollback can still see them, and users can remove them manually after confirming the new login. Windows standalone `npm run login/logout/host` has no DSH credential context: use the settings card instead. Linux/macOS standalone commands keep using the same system keychain. Different DSH homes remain isolated. DPAPI ciphertext is not a portable backup: another OS user/machine generally cannot decrypt it.
+
+Native Windows persistence smoke (fake credentials and an isolated temporary DSH document only):
+
+```sh
+node tools/credential-store-native-smoke.mjs --runtime <DSH-runtime-root>
+```
+
+The runtime root must contain compiled DSH SDK packages under node_modules. This checks real DPAPI encryption, native DSH atomic persistence, fresh-context restore, renewal and logout without accessing a daily profile. Linux/macOS command adapters have mock-contract tests; live keychain acceptance must run on those operating systems.
+
+## 0.1.32: DSH 0.2.2-alpha.2 compatibility
+
+- Accept the exact alpha session/settings carrier and `@deepseek-ai/schemastery@3.18.6-alpha.1` without installing another DSH runtime as a dependency.
+- Draft skill discovery uses `agentPresets.acquireScope()` and releases the revision after success or failure. Live Agents prefer their isolated preset skill service; older standing-key carriers retain their fallback.
+- Isolated alpha core-contract smoke exercises the real compatibility evaluator, Cordis Loader, Session message folding, and preset-scoped skill discovery. It also checks controller/settings/archive method presence. This is **not** full Web/profile-persistence/relay/handset acceptance; those remain unverified on alpha. No daily profile is modified or restarted.
+
+Reproduce without installing into a DSH profile:
+
+```sh
+npm install --prefix <isolated-npm-project> --ignore-scripts \
+  @deepseek-ai/dsh-sdk-minimal@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-api-session-controller@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-settings@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-agent-preset-registry@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-skill@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-workspace@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-home-paths@0.2.2-alpha.2 ws@8.21.3 werift@0.24.4
+```
+
+Unpack `npm pack` output beneath that npm project's directory, so its imports use the alpha peers, then run (the smoke asserts that resolution):
+
+```sh
+node tools/dsh-compat-smoke.mjs --runtime <isolated-npm-project> --plugin <unpacked-package>
+```
+
+For a full alpha-dependency regression, additionally copy the repository's test-only `test`, `tools`, `fixtures` directories and the root lockfile into that unpacked package and run `node --test` from it. These fixtures are intentionally not distributed in the npm tarball.
+
 ## 0.1.31: merged `main`, native rootless media fetch
 
 Absorbs the `main` branch on top of the 0.2.1 carrier. The one behavioral change that came from it: media and file-peer fetch now accept Cindy's **native URL shape**, where a project-folder export sends only `path` plus an optional `v` and no directory roots. Directory containment is therefore enforced only when the controller actually names roots; the never-serve denylist, the regular-file check, the 25 MiB cap and the separate authenticated-controller policy are unchanged. Also carried over: the native-contract fixture matrix (15 extensions × POSIX/Windows), the repository/docs snapshot, and a test that pins the rootless file-peer transfer end to end.
@@ -36,6 +81,96 @@ The ledger lives under the active DSH profile state directory. Pending payloads
 
 All changes are Host-only: no Cindy or DSH core patch is required. The handshake compatibility stamp is separate from the actual plugin version and explicit v1 capability. Unsupported optional features are refused; this is not a promise of all native Cindy features or exactly-once external tool effects.
 
+## Apple, enterprise SSO and regional login (0.1.33)
+
+In **Settings → Cindy 手机连接**, choose the same **Mainland China / Global** account region as the phone, then load sign-in options. The Host discovers enabled providers from that region: Apple/social browser authorization, phone/email codes and enterprise SSO follow Cindy's official protocol. Provider availability is server-controlled; the same Apple ID does not merge accounts across regions. The browser opens the official Cindy authorization page; return to DSH for membership selection, required contact binding or extra SSO verification. Secrets and tickets stay in the Host, not settings or browser storage.
+
+Organization ID/slug/domain and email discovery check both regions. A found organization in the other region requires explicit confirmation; ambiguous or partly failed discovery never silently picks a region. Cancel/start-over fences late browser, code and vault-write results. Login while the phone-connection switch is off saves only; it does not enable transport. Account/region changes rebuild the whole runtime so relay, device directory, media staging and ICE remain in the credential's region. Existing encrypted credentials are preserved; failures never erase them.
+
+**CAPTCHA browser limitation:** when a region requires it for code delivery, open the official verification page, solve it, then copy its complete successful URL (including `#cindy-captcha=ok.…`) into the DSH form. The standard browser cannot read the cross-origin result automatically. The verification proof is sensitive and short-lived: do not share it. The Host validates its official origin and forwards only the proof to the requested auth action; it does not bypass verification or proxy/inject the challenge page. Apple/SSO browser authorization does not use this manual code-delivery step.
+
+This feature ships in 0.1.33; installation and runtime activation are verified separately. Tests cover protocol, real local callbacks, settings-panel state, credential races and both regions' actual runtime URL routing with fake credentials. Real Apple/enterprise identity providers and iOS discovery/file round trips still require an authorized test account after deployment. See [authentication flow notes](doc/auth-login.md). The new browser flow is exposed by the settings page; the older interactive CLI is not a replacement for that UI on Windows.
+
+## Thinking content on Cindy mobile (0.1.33)
+
+The Host sends DSH-provided public reasoning text/summaries as native structured `thinking` content (`{ text }`), not ordinary prose strings. Expand the work/activity group, then its thinking row, to read it. No Cindy or DSH core patch is needed. Models that expose no reasoning text still have nothing to show; signatures and provider-private replay metadata are never forwarded.
+
+During generation, `assistant/chunk` reasoning deltas are displayed as temporary thinking rows. Pushes coalesce over 100 ms; the work-grouped history uses the existing coalesced view refresh. Opening a session mid-generation reconstructs the current prefix from the log. The final assistant message replaces the preview, including interrupted prefixes, without duplicating it. Temporary rows do not become durable message-count/grouping evidence, and timers are cleared on Host disconnect.
+
+This ships in 0.1.33; handset acceptance is separate from package checks and local Host activation. Offline regressions execute the pinned real Cindy mobile thinking normalizer; live phone/network acceptance remains separate.
+
+## Model switching follows DSH
+
+When native `sessionController.selectModel` is composed, the Host tells Cindy to delegate model-window decisions to DSH. Users may select another model during a running turn and select the original model again. DSH validates the provider/model/effort and records the selection for the **next model request**; an already-issued request is not interrupted. DSH owns context preparation and compaction, not Cindy's legacy 90%-window precheck or a Host-side summary/rebuild implementation.
+
+Missing capacity metadata is not a Host-side veto. Native DSH refusals still propagate (an unavailable route is reported as `NOT_AVAILABLE`), and no switch capability is advertised when the native selection API is absent. This is not a guarantee that every model request will succeed or that compaction is lossless. Re-selecting the original model does not undo any compaction already performed by DSH.
+
+## Native DSH session archive
+
+Controller archive/restore metadata now calls the same durable `workspaceRegistry.archiveSession` / `unarchiveSession` operations as DSH itself. Lists, exact reads and activity badges fold the native archive set; committed desktop changes invalidate controller lists and publish row patches. Archiving drops the pin without deleting history or changing workspace membership.
+
+The existing archive gesture does not request `stopActivity`, so DSH refuses sessions with running work; stop the work explicitly before archiving. Missing native archive services and storage failures are not downgraded to local-only success. Old controller-only archive flags remain visible until an explicit archive/restore retires that session's flag; upgrades do not bulk-archive native sessions. Delete remains a controller-only hide. Native pin membership is now projected separately as described below.
+
+## Native DSH pin membership
+
+Pin/unpin writes use native `workspaceRegistry.pinSession` / `unpinSession`; native desktop changes refresh controller lists and row patches. Repeating a pin does not reorder native pins. Archiving clears the native pin, and hidden/archived sessions cannot be newly pinned. Missing native pin APIs or persistence failures never become local-only success.
+
+DSH exposes an ordered ID set, not pin timestamps. The existing Cindy wire field therefore uses the fixed `1970-01-01T00:00:00.000Z` membership sentinel, **not** a claimed native timestamp or exact manual pin order. Legacy local pin flags remain readable until an explicit operation or corresponding native commit retires them; no automatic bulk migration occurs. Mixed rename/status/pin writes that native APIs cannot commit atomically are rejected before any side effect.
+
+## Native manual compaction subset
+
+`maker:compact-session` executes the target ordinary Agent's verified native scoped `/compact` command through `commands.execute`, not a text prompt or a Host summary engine. Only omitted or whitespace-only instructions are supported; nonempty instructions and the separate Claude queue-compaction protocol remain explicitly unsupported. Missing services/preset commands, busy maintenance and native errors never become successful no-ops. Benign no-history success maps to `{ noop: true }`; no native token counts are invented.
+
+The existing 11-minute Cindy timeout applies. The Host waits for the real command result, invalidates transcript/history reads after success or failure, and forwards source/link teardown or an accepted stop to the native cancellation signal. Cancellation is not a rollback guarantee. Repeated copies of the same envelope share an in-process bounded receipt, not a cross-restart exactly-once promise; new request identities are not automatically replayed.
+
+## Ordinary native fork subset
+
+`maker:fork(sourceSessionId, messageClientId)` locates the actual committed row using the shared message fold and one leased native observation. A human user point copies the prefix before that prompt; an assistant point includes its entire completed turn. DSH alone creates the child and selects its inherited cwd/preset/default model behavior. The source is not rewound or edited. The Host reads the real new row and emits the existing created notification.
+
+Unknown, ambiguous, shadowed, incomplete/aborted-turn, first-user-without-prior-assistant and unsafe mid-tool steering cuts are refused. Native history is bounded at 100,000 events; encrypted-stripping forks, branch navigation and in-place rewind remain unsupported. A known created child ID is retained and reported if Workspace attachment, discovery or source teardown fails; such a failure must not automatically trigger another fork. Native fork has no caller cancellation or durable idempotency key: duplicate envelopes are deduped only in-process, and disconnection is not a rollback guarantee.
+
+## Native literal keyword search
+
+The existing conversation-search channel uses the mounted native `sessionQuery.filterEvents` literal-text/current-surface API, even when global FTS is disabled. It searches only Host-visible ordinary sessions without waking an Agent, preserves real message/client identities and counts, and applies every accepted status/archive, display-agent alias, activity, ID and grouped-working-directory filter. Title matching uses the same unnamed-label string as Cindy. Relevance is deterministic keyword ranking, not a claimed native FTS/vector score.
+
+Keyword mode (also the Host default when omitted) returns `vectorUsed:false` with an explicit literal-only diagnostic; explicit hybrid requests are refused. Limits up to 200, including values over 20, are honored; larger limits and unknown fields refuse rather than silently narrowing. A scan has bounded candidates/events/text/time/concurrency/response size; exhausted budgets report `poolCapped:true`, while storage/read errors stay errors. Late cancelled reads are discarded and observation leases released. Up to three real message previews accompany a result. Host-only focused tests assert the request/response fields against the read-only official protocol reference.
+
+## Native background jobs: read-only subset
+
+The existing session-background-task list reads native `jobs.list(sessionId)`, the same public, owner-fenced registry operation used by DSH's job-controller roster stream. It includes that ordinary session's own and unowned active jobs, not other sessions' jobs, and never activates an Agent. Native `stopping` remains running (and is labelled stopping); terminal states are sent only from real native status evidence through existing `agent_task_update` events. Unknown/malformed/over-budget rosters refuse instead of becoming empty success.
+
+Cindy roster snapshots contain active tasks only. The optional `pendingContinuations` is omitted as unknown, never fabricated as zero. Native IDs receive stable job namespaces; titles identify DSH. No vendor provider, originating tool-call, output file, model token use or completion is invented. Status pushes reuse the source-owned DSH control stream with visibility/generation checks and bounded transient deduplication; no extra per-phone job stream or consuming output cursor is opened.
+
+Precise stop and output-tail channels are not in the verified official remote protocol and are not added. The native DSH kill/follow APIs remain DSH features, not newly exposed Cindy controls; ordinary input-stop retains its existing meaning. These are source/offline-contract changes, not a production reload or handset acceptance claim.
+
+## Native durable children: read-only subset
+
+The three existing subagent-run list/detail/transcript endpoints recheck an ordinary parent and its native durable child catalog on every request. Native descendant traversal is used when composed; disconnected/cyclic relations, external children and unknown/corrupt branches refuse explicitly rather than disappearing or becoming completed. No arbitrary session lookup or Agent resolution is used to grant access. Stable run IDs bind parent and native child IDs; the existing pi provider value is only a transport alias, with DSH clearly named in the title/description.
+
+Run status uses the real live-Agent lookup, registered native inbox view and host-provided public `foldConsumedWork` reader. Inactive does not mean completed; queued/unknown/unaccounted work is not presented as terminal success. The SDK package is a peer, never a private installed dependency graph. Missing services/helpers refuse dynamically. Resume, steer and stop stay false; returned-result capability stays false because a last assistant message is not evidence of delivery to the parent.
+
+History includes only the child-owned, committed public text and real tool-call/result pairs. Inherited parent history, constructor repair closers, injected/system/developer context, private request metadata and tool arguments are not exported. Long public text is split into stable ordered chunks, not silently clipped. Pages contain at most 25 entries with serialized-byte budgets and signed parent/child/catalog/source-bound continuation and tail cursors; teardown invalidates them and releases observations. The non-allowlisted subagent-runs-changed push is not emitted. Validation is focused Host tests only; Cindy source is read-only reference, not imported or executed. No deployment or handset acceptance is claimed.
+
+## Native reminders: existing-dialogue subset
+
+The five existing schedule CRUD calls use the mounted native schedule catalog/create/update/delete APIs. Writes accept an existing active ordinary dialogue, recurring native five-field cron or whole-second intervals of at least 60 seconds, the target's current agent alias, no model/workspace override and all notification switches off. Updates carry the complete observed native record as expected; conflicts are errors, never reread-and-overwrite retries. Explicit intervalMs:null clears an interval only with an expressible replacement cron rule.
+
+Read/delete includes existing native one-time records. Native inactive maps to expired, not paused; delivery timestamps are not model execution completion, run history, costs or unread counts. Unrepresentable fractional calendar rules and oversized data fail explicitly. Pause/resume/run-now/templates/scripts/run reports remain unsupported; this is not an equivalent automation runner or a claim that every scheduler-page control works.
+
+Committed native change notifications produce the existing ready list-invalidation event only for authorized linked peers. One shared observer closes on final unlink, revocation, source replacement or disconnect. Deleting a reminder does not stop an Agent or retract inbox input. Cancellation after persistence is not rollback; known created IDs survive readback/source failures. Write-envelope deduplication is bounded in-process, not durable exactly-once. Validation: 19 focused Host cases; no Cindy source execution, real reminder creation, publication or phone acceptance.
+
+## Native registered Workspace order
+
+Existing sidebar project-order get/apply calls project the native registered Workspace order as custom. Only unique local path keys are accepted; unknown paths, ambiguous worktree groups, duplicate keys, device/dialogue keys and activity mode refuse before any move. An account/device/source-bound owner stamp is available only after a verified relay handshake; it is authorization, not a fabricated order revision.
+
+Native insertBefore moves are serialized and checked against the actual registry after each step. Unrequested Workspaces retain relative order. This is not an atomic replace: concurrent desktop edits or partial persistence failures stop the sequence and report the real same-owner snapshot, without rollback. Native order changes feed the existing sidebar changed event. Twelve focused Host tests cover mapping, ownership, partial/concurrent failures and real Host handshake/source rotation; no live workspaces were reordered.
+
+## Session-reference source and consumption boundary
+
+The existing source-history call reads one authorized ordinary session through a single native observation and current-surface fold, without resolving an Agent. It implements user/assistant role, workdir/agent/time filters, native-position cursor pagination, bounded content with explicit truncation metadata, and a safe terminal-error hint captured from that same prefix. Rewound/all-role history is explicitly unavailable.
+
+Source readability does not imply target consumption. The existing target capability probe returns supported:false/version:1: native current-surface reference resolution cannot atomically admit Cindy frozen/anchored/cross-device snapshots. Nonempty structured references are refused before send/enqueue/steer/edit, durable preparation and replay, rather than silently dropping them or turning them into ordinary text. Empty carriers and literal text links retain ordinary behavior. Twelve focused source/boundary Host tests and 28 directly affected delivery cases passed; Cindy source remained read-only and unexecuted.
+
 ## Previous release and rollback
 
 0.1.26 added editable, locally persistent Host names and desktop-safe plain-text queue content. Reinstalling 0.1.26 is possible, but pause input first and preserve the 0.1.27 ledger: downgrading disables durable-input recovery until 0.1.27 is restored.